Re: [Exim] virurstest.org test #19

トップ ページ
このメッセージを削除
このメッセージに返信
著者: David
日付:  
To: exim-users
題目: Re: [Exim] virurstest.org test #19
Hi !!

>>well, i also tried "\n \n" "\n\t\n" "\n( |\t)\n" and none work
>
>
> "\n\s\n" works for me, at least in a user filter file. The test message
> I used contained this:
>
> Note: Exim removes continuation lines that just contain white space if
> they appear at the end of a header line, in order to avoid confusing
> people. That is why my test had the additional continuation line "some
> more text", so that the blank line is not at the end of the header line.
> Maybe your test didn't have that?


I'm trying this data acl:

   deny    condition   = ${if match{$message_headers}{\n\s\n}{yes}{no}}
           message     = Blank Folding Vulnerability detected


I tested it using /usr/local/exim/bin/exim -bh 62.97.102.1 and get the
following:

-----(after MAIL FROM adn RCPT TO)
DATA
354 Enter message, ending with "." on a line by itself
Message-Id: <4.3.2.7.0.20001102202253.00adb610@???>
Date: Thu, 10 Feb 2003 20:23:17 -0500
>>> host in ignore_fromline_hosts? yes (matched "*")

From: "WebMaster" <webmaster-vir@???>
To: "User" <user@???>
Subject: Test eicar.com file [eicarblankfolding]

Mime-Version: 1.0


Hola
.
----(some other test here)
 >>> processing "deny"
 >>> check condition = ${if match{$message_headers}{\n\s\n}{yes}{no}}
 >>>                 = no
 >>> deny: condition test failed


the line between Subject and Mime has only a white space

--
Thanx & best regards ...

We give nothing as willingly as our advice.

----------------------------------------------------------------
    David Saez Padros                http://www.ols.es
    On-Line Services 2000 S.L.       e-mail  david@???
    Pintor Vayreda 1                 telf    +34 902 50 29 75
    08184 Palau-Solita i Plegamans   movil   +34 670 35 27 53
----------------------------------------------------------------